{"record":{"id":"016426e2839191e2","repo":"PHPOffice/PhpSpreadsheet","slug":"could-not-create-temporary-file","errorCode":null,"errorMessage":"Could not create temporary file","messagePattern":"Could not create temporary file","errorType":"exception","errorClass":"PhpOffice\\PhpSpreadsheet\\Exception","httpStatus":null,"severity":"error","filePath":"src/PhpSpreadsheet/Shared/File.php","lineNumber":134,"sourceCode":"        $path = sys_get_temp_dir();\n        if (self::$useUploadTempDirectory) {\n            //  use upload-directory when defined to allow running on environments having very restricted\n            //      open_basedir configs\n            if (ini_get('upload_tmp_dir') !== false) {\n                if ($temp = ini_get('upload_tmp_dir')) {\n                    if (file_exists($temp)) {\n                        $path = $temp;\n                    }\n                }\n            }\n        }\n\n        return realpath($path) ?: '';\n    }\n\n    public static function temporaryFilename(): string\n    {\n        return tempnam(self::sysGetTempDir(), 'phpspreadsheet') ?: throw new Exception('Could not create temporary file');\n    }\n\n    /**\n     * Blocks phar:// and similar RCE-bearing wrappers.\n     * Note that many protocols, including http and zip, will already\n     * return false for is_file.\n     * A whitelist of protocols may be added if needed in future.\n     * data: is intentionally allowed (see #4823); callers needing strict\n     * on-disk-only semantics must validate $filename themselves.\n     */\n    public static function prohibitWrappers(string $filename): void\n    {\n        if (\n            Preg::IsMatch('~^phar://~i', $filename)\n            || (Preg::isMatch('/^([\\w.\\s\\x00-\\x1f]+):/', $filename) && !Preg::isMatch('/^([\\w.]+):/', $filename))\n            || Preg::isMatch('~^[\\w.]+://.*phar:~is', $filename)\n        ) {\n            throw new Exception(","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/PHPOffice/PhpSpreadsheet/blob/65b080eef4d9fd11a5796135ab145883e5c3d6a6/src/PhpSpreadsheet/Shared/File.php#L116-L152","documentation":"File::temporaryFilename() wraps tempnam(sysGetTempDir(), 'phpspreadsheet') and throws when tempnam returns false, i.e. the system temporary directory could not be used (src/PhpSpreadsheet/Shared/File.php:134). Save paths that need scratch space — CSV/PDF writers, large spreadsheet writes — all funnel through it, so a broken temp dir breaks every save.","triggerScenarios":"The temp directory is full (bytes or inodes), missing, or unwritable for the PHP runtime user; open_basedir excludes sys_getTempDir(); containers run with a read-only root filesystem and no writable TMPDIR; upload_tmp_dir misconfigured to a nonexistent path.","commonSituations":"Kubernetes containers with readOnlyRootFilesystem and no emptyDir mount; shared hosting with restrictive open_basedir; disk exhausted after repeated large exports; CI environments with tiny tmpfs.","solutions":["Point TMPDIR at a writable directory before saving: putenv('TMPDIR=/var/app/tmp') (and ensure it exists with the right ownership), or fix upload_tmp_dir/sys temp config","Free space or inodes on the temp filesystem","Adjust open_basedir to include the temp directory","Run PHP under a user with write access to the temp dir"],"exampleFix":"// before\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Xlsx($spreadsheet);\n$writer->save('php://output'); // throws: Could not create temporary file\n\n// after\n$tmp = '/var/app/tmp';\nif (!is_dir($tmp)) { mkdir($tmp, 0770, true); }\nputenv('TMPDIR=' . $tmp);\n$writer->save('php://output');","handlingStrategy":"fallback","validationCode":"use PhpOffice\\PhpSpreadsheet\\Shared\\File;\n\nfunction ensureTempDirAvailable(): void\n{\n    $dir = sys_get_temp_dir();\n    if (!is_dir($dir) || !is_writable($dir)) {\n        $alt = __DIR__ . '/../storage/tmp';\n        if (!is_dir($alt)) { mkdir($alt, 0770, true); }\n        putenv('TMPDIR=' . $alt); // tempnam() uses this via sysGetTempDir()\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Health-check the temp dir in deployment smoke tests (is_writable + free space)","Mount a writable emptyDir/tmpfs on read-only containers and set TMPDIR","Monitor disk and inode usage on export-heavy services","Run PHP under a user with temp-dir write access"],"tags":["filesystem","temp-file","environment","disk-full","permissions"],"backgroundTag":"temp-file-creation-failed","analyzedSha":"65b080eef4d9fd11a5796135ab145883e5c3d6a6","analyzedAt":"2026-08-17T05:40:41.646Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}